NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions

Cybersecurity researchers have revealed a new phishing toolkit called NovaCookies, which is used to capture Microsoft 365 authenticated sessions. This adversary-in-the-middle toolkit acts as a proxy to redirect Microsoft 365 sign-ins. The NovaCookies service is subscription-based, costing $320 per month, and is described as a phishing platform. It abuses legitimate Docusign notifications to steal sessions. The toolkit is designed to intercept and capture authenticated sessions, allowing attackers to gain access to Microsoft 365 accounts.